What is a Strong Password? The Rules Have Changed
The old advice — uppercase, numbers, symbols — is outdated. Here's what security professionals actually recommend in 2026.
The old rules are wrong
For years, password advice focused on complexity: uppercase letters, numbers, special characters. The problem is that complexity makes passwords hard to remember but not necessarily hard to crack. "P@ssw0rd!" is technically complex but appears in every password cracking dictionary.
The National Institute of Standards and Technology (NIST) updated its password guidelines in 2024 to reflect what security researchers have known for years: length beats complexity.
What actually makes a password strong
Length is the most important factor. A 16-character password of random words is vastly more secure than an 8-character password with symbols. Every additional character multiplies the difficulty of a brute-force attack exponentially.
Passphrases are the gold standard. Four or more random words strung together — "correct horse battery staple" — are both highly secure and actually memorable. Random is the key word: "ilovemydog" is not a passphrase, it's a predictable phrase.
Uniqueness matters as much as strength. The strongest password in the world is useless if you use it on multiple sites. When one site is breached, attackers try those credentials everywhere else — a technique called credential stuffing. Every account needs a unique password.
The only practical way to do this
No human can remember dozens of unique, strong passwords. A password manager is not optional — it's the only realistic way to implement proper password hygiene. The password manager generates, stores, and fills your passwords so you only need to remember one strong master password.
Bitwarden is free, open source, and independently audited. 1Password is the best paid option. Either one eliminates the password problem entirely.
What to do right now
- Install a password manager if you don't have one
- Change your email account password to a unique 16+ character passphrase
- Enable two-factor authentication on your email and financial accounts
- Check haveibeenpwned.com to see if your email has been in a breach